# SIRAS | Security Incident Response Automated Simulations

**URL:** <https://onehack.st/t/siras-security-incident-response-automated-simulations/197302>\
**Category:** Tools & Scripts\
**Tags:** tools, programming, freebies\
**Created:** [August 11, 2021, 10:15pm UTC](https://onehack.st/t/siras-security-incident-response-automated-simulations/197302 "2021-08-11T22:15:52Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![PlayBoy83](https://onehack.st/user_avatar/onehack.st/playboy83/32/164314_2.png) [@PlayBoy83](https://onehack.st/u/PlayBoy83)\
**Post date:** [August 11, 2021, 10:15pm UTC](https://onehack.st/t/siras-security-incident-response-automated-simulations/197302/1 "2021-08-11T22:15:52Z")

</div>

[![](https://github.com/cloud-sniper/cloud-droid/raw/main/images/cloud-droid.png)](https://github.com/cloud-sniper/cloud-droid/blob/main/images/cloud-droid.png)

_ **Cloud Droid** _ is a platform designed to manage Incident and Response Simulations; you can execute controlled actions that let you test your Incident Response plan in realistic scenarios.

The main goal of _ **Cloud Droid** _ is to provide red teaming exercises as code, generating simulations against attack scenarios and highlighting possible failures in your incident response plan. The tests are called _ **Smokers** _, each one executing real actions and then cleaning up the resources created during execution.

The system is currently available for _AWS_, but it is to be extended to others cloud platforms.

### How it works?

[![alt text](https://github.com/cloud-sniper/cloud-droid/raw/main/images/cloud-droid-diagram.png "DIAGRAM")](https://github.com/cloud-sniper/cloud-droid/blob/main/images/cloud-droid-diagram.png)

### How to run it?

#### Using the official Docker image:

docker run --rm \ -e AWS\_ACCESS\_KEY\_ID \ -e AWS\_SECRET\_ACCESS\_KEY \ -e AWS\_SESSION\_TOKEN \ -e AWS\_DEFAULT\_REGION=us-east-1 \ cloudsniper/cloud-droid:latest -s XXXX -B XXXX

#### Running Docker build:

1. Build the Docker image.

docker build -t cloud-droid .

1. Run the container by passing your aws credentials.

docker run --rm \ -e AWS\_ACCESS\_KEY\_ID \ -e AWS\_SECRET\_ACCESS\_KEY \ -e AWS\_SESSION\_TOKEN \ -e AWS\_DEFAULT\_REGION=us-east-1 \ cloud-droid -s XXXX -B XXXX

#### Mandatory command options for running _ **Cloud Droid** _

You must use the _ **-s** _ option to run a _ **Smoker** _.

| -s | Description |
| --- | --- |
| **all** | Run all _ **Smokers** _ |
| **test** | Test Cloud Droid |
| **sg** | Create an open security group |
| **pa** | Multiple authentication failure in Palo Alto VPN portal. Must configure _ **pano\_url** _ located in _ **smoker/PanAuthSmoker.py** _ |
| **au** | Create an administrator user |
| **aca** | Multiple authentication failure in AWS console. Must configure _ **account\_id** _ located in _ **smoker/awsConsoleAuthSmoker.py** _ |
| **ctr** | Create a CloudTrail trail |
| **s3p** | Create a public S3 bucket |
| **esb** | Create a public EBS snapshot. Must configure a snapshot id in _ **smoker/EBSPublicSmoker** _ - line27 |

#### Optional command options to run _ **Cloud Droid** _

| -b | Description |
| --- | --- |
| **True** | Store the results in an S3 bucket |
| **False** | This is the default option, it prints the output on the console |

### Requirements

- Docker
- AWS Credentials
- Variable named ‘BUCKETS3’ to store records in S3.

### Upcoming _ **Smokers** _

- Kubernetes
- AWS VPC changes
- AWS EC2
- GuardDuty

### Get Involved

- [EMAIL](mailto:cloudsniper.cba@gmail.com)
- [SLACK](https://join.slack.com/t/cloudsniper/shared_invite/zt-gdto90pu-C25tsP54IOqTZd8ykQHmTw)

### Contributing

We welcome all contributions, suggestions, and feedback, so please do not hesitate to reach out.

Ways you can contribute:

1. Report potential bugs
2. Request a feature
3. Join our community
4. Submit a PR for open issues
5. Fix or improve documentation

### Code of Conduct

This project adheres to the Linux Foundation [Code of Conduct](https://events.linuxfoundation.org/about/code-of-conduct/) available on the event page. By participating, you are expected to honor this code.

## GitHub:

[https://github.com/cloud-sniper/cloud-droid](https://github.com/cloud-sniper/cloud-droid)